From 5560e5ebc4f2d0dc8f7493947bc46524352b9fe5 Mon Sep 17 00:00:00 2001
From: niksis02 <sisnikoyan@gmail.com>
Date: Tue, 8 Apr 2025 01:05:59 +0400
Subject: [PATCH] fix: Returns ErrSignatureVersionNotSupported for sigV2 signed
 requests.

Fixes #1171

As signature v2 is depracated the gateway doesn't support it.
AWS S3 supports signature version 2 in some regions. For some regions the request fails with error:
```
InvalidRequest: The authorization mechanism you have provided is not supported. Please use AWS4-HMAC-SHA256.
```

 The PR makes this change to return unsupported authorization mechanism for `sigV2` requests.
---
 s3api/middlewares/authentication.go | 4 ----
 s3api/utils/auth-reader.go          | 4 ++++
 tests/integration/tests.go          | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/s3api/middlewares/authentication.go b/s3api/middlewares/authentication.go
index 9d42aacb..ed0479f6 100644
--- a/s3api/middlewares/authentication.go
+++ b/s3api/middlewares/authentication.go
@@ -63,10 +63,6 @@ func VerifyV4Signature(root RootUserConfig, iam auth.IAMService, logger s3log.Au
 			return sendResponse(ctx, err, logger, mm)
 		}
 
-		if authData.Algorithm != "AWS4-HMAC-SHA256" {
-			return sendResponse(ctx, s3err.GetAPIError(s3err.ErrSignatureVersionNotSupported), logger, mm)
-		}
-
 		if authData.Region != region {
 			return sendResponse(ctx, s3err.APIError{
 				Code:           "SignatureDoesNotMatch",
diff --git a/s3api/utils/auth-reader.go b/s3api/utils/auth-reader.go
index 990e5a33..fed3d4c3 100644
--- a/s3api/utils/auth-reader.go
+++ b/s3api/utils/auth-reader.go
@@ -190,6 +190,10 @@ func ParseAuthorization(authorization string) (AuthData, error) {
 
 	algo := authParts[0]
 
+	if algo != "AWS4-HMAC-SHA256" {
+		return a, s3err.GetAPIError(s3err.ErrSignatureVersionNotSupported)
+	}
+
 	kvData := authParts[1]
 	kvPairs := strings.Split(kvData, ",")
 	// we are expecting at least Credential, SignedHeaders, and Signature
diff --git a/tests/integration/tests.go b/tests/integration/tests.go
index d4568853..0604c98b 100644
--- a/tests/integration/tests.go
+++ b/tests/integration/tests.go
@@ -81,7 +81,7 @@ func Authentication_invalid_auth_header(s *S3Conf) error {
 		service:  "s3",
 		date:     time.Now(),
 	}, func(req *http.Request) error {
-		req.Header.Set("Authorization", "invalid header")
+		req.Header.Set("Authorization", "invalid_header")
 
 		resp, err := s.httpClient.Do(req)
 		if err != nil {